Class: Spektr::Checks::BasicAuthTiming

Inherits:
Base
  • Object
show all
Defined in:
lib/spektr/checks/basic_auth_timing.rb

Instance Attribute Summary

Attributes inherited from Base

#name

Instance Method Summary collapse

Methods inherited from Base

#app_version_between?, #dupe?, #model_attribute?, #should_run?, #target_affected?, #user_input?, #version_between?, #warn!

Constructor Details

#initialize(app, target) ⇒ BasicAuthTiming

Returns a new instance of BasicAuthTiming.



5
6
7
8
9
10
 
# File 'lib/spektr/checks/basic_auth_timing.rb', line 5

def initialize(app, target)
  super
  @name = "Timing attack in basic auth (CVE-2015-7576)"
  @type = "Timing attack"
  @targets = ["Spektr::Targets::Controller"]
end

Instance Method Details

#run ⇒ Object 



12
13
14
15
16
17
 
# File 'lib/spektr/checks/basic_auth_timing.rb', line 12

def run
  return unless super
  if @target.find_calls(:http_basic_authenticate_with).any?
    warn! @target, self, @target.find_calls(:http_basic_authenticate_with).first.location, "Basic authentication in Rails #{@app.rails_version} is vulnerable to timing attacks."
  end
end

#version_affected ⇒ Object 



19
20
21
 
# File 'lib/spektr/checks/basic_auth_timing.rb', line 19

def version_affected
  Gem::Version.new("4.2.5")
end